Bulletin ID: 2026-167-AWS Publication Date: 11/03/2026 10:30 AM PST Description: maplibre-gl-js-amplify is an open-source AWS Amplify library that…
Tag: Vulnerability
CVE-2026-119922 – Babelfish for PostgreSQL Privilege Escalation
Bulletin ID: 2026-165-AWS Publication Date: 11/03/2026 10:00 AM PST Description: Improper access control in the Babelfish for PostgreSQL extension…
CVE-2026-115413 – AWS API MCP Server OAuth token audience validation bypass
Read this article
Hackers Exploit Zyxel GS1900 Zero-Day Vulnerability to Compromise Nearly 1,000 Network Switches
Attackers used a pre-authentication remote code execution exploit against Zyxel GS1900 switches. They compromised nearly 1,000 devices before Zyxel…
Debian and Ubuntu Linux APT Vulnerability Allows Attackers to Execute Malicious Code With Root Privileges
A vulnerability in the APT package manager lets attackers intercept communications between Linux systems and package repositories, install malicious…
UK Warns of Unprecedented Rise in Cyberattacks as AI Accelerates Vulnerability Exploitation
The United Kingdom could face an unprecedented increase in cyberattacks over the coming months as artificial intelligence enables hackers to identify and…
CVE-2026-122266 – Improper isolation of shared resources in aws-network-policy-agent in Amazon EKS
Bulletin ID: 2026-170-AWS Publication Date: 11/04/2026 13:30 PM PST Description: We identified CVE-2026-122266, an issue in Amazon EKS Network Policy…
Zyxel fixes zero-day exploited to hack nearly 1,000 network switches
Zyxel has patched a zero-day vulnerability in its GS1900 series network switches that hackers exploited to compromise nearly 1,000 devices worldwide and…
CVE-2026-122192 – Guest Access to Firecracker Process Memory After a Failed Memory Discard
Bulletin ID: 2026-169-AWS Publication Date: 11/04/2026 11:30 AM PST Description: We identified CVE-2026-122192, an issue in Firecracker v0.23.0 through…
Node.js Security Releases: Patching Node2Shell (CVE-2026-111497) & High Risks
HOC Shorts | Node.js security issuing updates across active release channels (v22.x, v24.x, and v26.x), patching multiple vulnerabilities…
CVE-2026-98432: A Remote Use-After-Free in the Linux Kernel’s TCP Stack
Learn about CVE-2026-98432, a critical remote use-after-free flaw in the Linux kernel TCP stack, its root exploit risks, affected versions, and mitigation…
CVE-2026-120497 – Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows
Bulletin ID: 2026-163-AWS Publication Date: 11/02/2026 11:00 AM PST Description: aidlc-traceability is an open source command-line tool, formerly…
Gorbag Hackers Exploit WinRAR Vulnerability to Steal Credentials From Ukrainian Government Agencies
Russia-aligned hackers tracked as Gorbag are exploiting a WinRAR vulnerability to steal browser credentials, VPN configurations, and sensitive documents…
CVE-2026-105811 – Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS
Read this article Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
CVE-2026-116635 – Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server
Bulletin ID: 2026-164-AWS Publication Date: 11/02/2026 13:30 PM PST Description: We identified CVE-2026-116635. Under certain conditions, improper…
CVE-2026-119301 – Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas
Bulletin ID: 2026-161-AWS Publication Date: 11/02/2026 08:30 AM PST Description: We are aware of CVE-2026-119301 in the Apache Iceberg write component,…
CVE-2026-119085 – Template injection in the publishing component of Virtual Engineering Workbench
Bulletin ID: 2026-162-AWS Publication Date: 11/02/2026 09:30 AM PST Description: Virtual Engineering Workbench (VEW) is an open-source platform where…
HTTP2Shell: What the Critical Brotli Vulnerability Means for WordPress Sites
On October 22, 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project released fixed versions. The…
Russia-Aligned Gorbag APT Exploits WinRAR CVE-2025-8088 to Deploy BeautyStealer Infostealer
A targeted cyberespionage campaign by Gorbag, a Russia-aligned threat actor exploiting WinRAR vulnerability CVE-2025-8088 to deploy BeautyStealer against…
SMS of Death: Android Zero-Click DoS Vulnerability
A critical zero-click vulnerability in Android’s messaging framework allows attackers to crash phone services and block emergency calls by sending a…